Cisco Talos published its CAIRN research on September 22 describing CLOSEDQUORUM, a Windows implant that queries up to four AI models and acts on whatever the majority votes for, rather than waiting on instructions from an operator's command-and-control server. The mechanism is a quorum: the binary submits its situation (what's running, what's been blocked, what's exposed) to each model, collects a vote on the next move, and executes the outcome. That is a design choice with a specific consequence. It removes the one signal defenders have always relied on to attribute and disrupt a campaign, a steady operator issuing commands from a fixed infrastructure, and replaces it with a decision loop that can vary run to run depending on which models answer and how.

The effect shows up downstream. BleepingComputer reported the same week that a separate financially motivated actor used open-source AI agent frameworks to run skimmer operations across more than 100 retail sites, lifting over 600,000 card records. Talos's binary and the skimmer campaign are not the same operation, but they share a premise: the decision-making that used to require a live operator now runs on infrastructure the attacker doesn't have to staff. Talos's writeup frames CLOSEDQUORUM as a "shift in effort displacement," which is accurate and also undersells it. Effort displacement usually means a human did less typing. Here it means the artifact defenders normally chase, the C2 channel carrying operator intent, doesn't exist in the same form.

What's actually implicated is the model layer itself, not a named vendor's product. Talos doesn't name which four models CLOSEDQUORUM queries, and that gap matters more than the binary's other capabilities: any provider whose API can be reached anonymously and queried for a next-step recommendation is a candidate component in this architecture. The malware's resilience depends entirely on model API access staying open and unattributed, not on any exploit or credential theft. That is the fact that settles how serious this is: the binary itself is unremarkable, and the availability of anonymous, unmonitored model access is what makes the design work.